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Amendments to the Claims : 

This listing of claims will replace all prior versions, and listings, of claims in 
the application: 

1. (Currently Amended) A method for reconstructing a path taken by 
undesirable network traffic through a computer network from a source of the traffic , the 
computer network including collectors located at fixed points within the network , the method 
comprising: 

collecting statistics at the collectors located at the fixed points from at a plurality 
of measurement points located within routing and forwarding infrastructure of the computer 
networ k, the collectors interfacing with the forwarding infrastructure and taking samples of 
statistics from the infrastructure : and 

analyzing the samples of statistics to reconstruct the path taken by the 
undesirable network traffic through the network from the source of the traffic. 

2 . (Original) The method as claimed in claim 1 further comprising blocking 
undesirable network traffic within the computer network upstream of the points based on the 
reconstructed path. 

3. (Original) The method as claimed in claim 1 wherein the routing and 
forwarding infrastructure includes at least one router. 

4. (Original) The method as claimed in claim 1 wherein the statistics 
include flow-based statistics which provide information related to the same logical traffic flow. 

5. (Previously Presented) The method as claimed in claim 1 wherein the 
statistics include packet statistics which provide information about a set of packets entering the 
routing and forwarding infrastructure. 
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6. (Original) The method as claimed in claim 1 further comprising 
requesting and receiving upstream statistics from forwarding infrastructure of the computer 
network upstream the measurement points and wherein the step of analyzing includes the step 
of analyzing the upstream statistics to reconstruct the path taken by the undesirable network 
traffic. 

7. (Original) The method as claimed in claim 1 wherein the step of 
analyzing includes the step of extracting profiles from the statistics collected at the plurality 
of measurement points and comparing the profiles to reconstruct the path taken by the 
undesirable network traffic. 

8. (Original) The method as claimed in claun 1 wherein the computer 
network is the Internet. 

9. (Currently Amended) A system for reconstructing a path taken by 
undesirable network traffic through a computer network from a source of the traffic, the system 
comprising: 

collectors located at fixed points within the computer network for collecting 
statistics from at a plurality of measurement points located within routing and forwarding 
infrastructure of the computer networ k, the collectors interfacing with the forwarding 
infrastructure and taking samples of statistics from the infrastructure : and 

at least one controller in communication with the collectors for analyzing the 
samples of statistics to reconstruct the path taken by the undesirable network traffic through 
the network from the source of the traffic. 

10. (Original) The system as claimed in claim 9 further comprising means 
in communication with the at least one controller for blocking undesirable network traffic 
within the computer network upstream of the points based on the reconstructed path. 
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1 1 . (Previously Presented) The system as claimed in claim 9 wherein the 
routing and forwarding infrastructure includes at least one router, 

12. (Original) The system as claimed in claim 9 wherein the statistics 
include flow-based statistics which provide information related to the same logical traffic flow. 

13. (Previously Presented) The system as claimed in claim 9 wherein the 
statistics include packet statistics which provide information about a set of packets entering the 
routing and forwarding infrastructure, 

14. (Original) The system as claimed in claim 9 further comprising means 
for requesting and receiving upstream statistics from forwarding infrastructure of the computer 
network upstream the measurement points and wherein the at least one controller analyzes the 
upstream statistics to reconstruct the path taken by the undesirable network traffic. 

15. (Original) The system as claimed in claim 9 wherein the controller 
extracts profiles from the statistics collected at the plurality of measurement points and 
compares the profiles to reconstruct the path taken by the undesirable network traffic. 

16. (Original) The system as claimed in claim 9 wherein the computer 
network is the Internet. 

17. (Original) The method as claimed in claim 1 wherein the undesirable 
network traffic includes denial of service attacks. 

18. (Original) The method as claimed in claim 17 wherein the computer 
network includes a plurality of service provider networks. 

19. (Original) The system as claimed in claim 9 wherein the undesirable 
network traffic includes denial of service attacks. 
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20. (Original) The system as claimed in claim 19 wherein the computer 
network includes a plurality of service provider networks. 



